Testing is a bit hard, because I don't want to test and debug inside a hot car
At first, I started with some simple curl requests:
Bash:
curl -i http://192.168.155.206:25010
curl: (1) Received HTTP/0.9 when not allowed
It turns out, curl can't handle the xml data that came back, but this was working:
Bash:
curl --http0.9 -i http://192.168.155.206:25010
<Status>
<Init/>
</Status>
Look at the included PDF, you'll see this is regular output when sending no data.
So I made a POST request with some XML data:
Bash:
curl --http0.9 -X POST http://192.168.155.206:25010 -H "Content-Type: application/xml" -H "Accept: application/xml" -d "<Req id='1'><Protocol version='1' returnCapabilities='true'/></Req>"
<Status>
<Init/>
</Status>
<Rsp id="1">
<Capabilities description="Dies ist der VW Standard Application Interface Server. API Level 5" service="VW SAI-Server HIGH" version="5.0" id="CENSORED">
<Supports protocol="1.3" interface="true" authenticate="true" heartbeat="true" datTimeStamp="true"/>
</Capabilities>
</Rsp>
Pretty cool, that's the system actually replying with something sensible!
I had a look at the exlap specs, and next I sent a message to get a listing of supported URLs, by using the DIR command.:
Bash:
curl --http0.9 -X POST http://192.168.155.206:25010 -H "Content-Type: application/xml" -H "Accept: application/xml" -d "<Req id='4'><Dir/></Req>"
<Status>
<Init/>
</Status>
<Rsp id="4">
<UrlList>
<Match url="vehicleIdenticationNumber"/>
</UrlList>
</Rsp>
Not much to see there, besides the VIN, but I could query it:
Bash:
curl --http0.9 -X POST http://192.168.155.206:25010 -H "Content-Type: application/xml" -H "Accept: application/xml" -d "<Req id='11'><Subscribe url='vehicleIdenticationNumber' ival='800'/></Req>"
<Status>
<Init/>
</Status>
<Rsp id="11"/>
<Dat url="vehicleIdenticationNumber">
<Txt name="VIN" val="CENSORED"/>
</Dat>
I know there are more data elements available, so I tried one of them:
Code:
curl --http0.9 -X POST http://192.168.155.206:25010 -H "Content-Type: application/xml" -H "Accept: application/xml" -d "<Req id='11'><Subscribe url='engineSpeed' ival='800'/></Req>"
<Status>
<Init/>
</Status>
<Rsp id="11" status="noMatchingUrl"/>
I guess I need some authentication. Here's the funny part: they've changed the authentication since the specs were written, and user authentication is now done as follows:
Code:
base64(sha256(username:password:nonce:cnonce))
Upon sending an authentication request, the server will reply with a nonce, which you have to reply to by supplying an answer. So I made a simple calculator that would generate the digest value, and tried to authenticate myself:
Bash:
curl --http0.9 -X POST http://192.168.155.206:25010 -H "Content-Type: application/xml" -H "Accept: application/xml" -d "<Req id='2'><Authenticate phase='challenge'/></Req>
> "
<Status>
<Init/>
</Status>
<Rsp id="2">
<Challenge nonce="xwtCCB+nScrcBK3epfEcTg=="/>
</Rsp>
But.. then there was a catch.. curl kept the connection open after this response, and didn't allow me to send a new request... I had to CTRL-C out of curl, to send the reply:
Bash:
curl --http0.9 -X POST http://192.168.155.206:25010 -H "Content-Type: application/xml" -H "Accept: application/xml" -d "<Req id='3'><Authenticate phase='response' cnonce='qdnpqMqBRpVneAc/PP2mHQ==' digest='JuqGXLFDgG3AhCdn0qlC3nbinZu26m3z2zGluyE1Nv4=' user='RSE_3-DE1400'/></Req>"
<Status>
<Init/>
</Status>
<Rsp id="3" status="error" msg="response has to be preceeded by challenge"/>
As you can see, a new session was initiated, and therefore my previous authentication nonce was no longer valid. I had no idea
how to continue doing this with curl, so I tried some other options... Postman, Insomnia, SoapUI all didn't really like the XML response from the server, which sucks, as there's no way to see the exact raw value inside the tools when they cannot parse the response.
So.... now I'm writing a small websockets client in Python, so I can keep on sending and receiving data while keeping the socket open.
After that, the plan is as follows:
- Try all known username passwords I've found inside VW/Seat/Skoda/Audi apps that use Exlap data
- See if there's any difference in output on the DIR command. I hope the devs were sloppy and some of the public users have more rights than others.
- Then I'll try to find the function to update some data like song title or connected bluetooth client name. If that works, hopefully we'll be able to override the "Android Auto" title there.
Sidenote: I did a lot of research to find where the MIB is actually getting the "Android Auto" string from. I replaced all of the Android Auto strings inside the language file on the MIB, but that didn't do the trick... let's hope this method works.
